fix user authorization for collections and items